Unrestricted Resource Consumption — API Security in Depth

Every API call consumes CPU, memory, storage, bandwidth and sometimes money (SMS, email, LLM tokens, third-party fees). Without limits, attackers or buggy clients cause outages and bills. Apply limits at every layer: request size, page size, upload size, query complexity (GraphQL depth/cost), execution timeouts, rate limits and quotas per key/user/IP, concurrency limits, and spending caps on paid side effects (max SMS per phone per day).

Limits checklist

Resource	Limit	Where
Request body	e.g. 1 MB JSON	Gateway / framework
Page size	max 100	API validation
Uploads	Size + count + type	Pre-signed URL policy
Query cost	Depth ≤ 10, cost ≤ 1000	GraphQL server
Time	Request/DB statement timeouts	App + DB
Rate / quota	Per key/user/IP/tenant	Gateway + app
Paid side effects	SMS/email per recipient per day; budget alerts	Business logic
Batch operations	Max items per batch	API validation

class ListParams(BaseModel):
    limit: int = Field(20, ge=1, le=100)
    cursor: str | None = Field(None, max_length=200)

@router.post("/v1/otp")
async def send_otp(body: OtpIn, ip: str = Depends(client_ip)):
    await limiter.hit(f"otp:phone:{body.phone}", limit=3, window=3600)    # per recipient
    await limiter.hit(f"otp:ip:{ip}", limit=10, window=3600)               # per source
    await sms.send(body.phone, make_code())

import depthLimit from "graphql-depth-limit";
import { createComplexityRule, simpleEstimator } from "graphql-query-complexity";

const server = new ApolloServer({
  schema,
  validationRules: [depthLimit(10), createComplexityRule({ maximumComplexity: 1000, estimators: [simpleEstimator({ defaultComplexity: 1 })] })],
});

client_max_body_size 1m;
limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s;
location /v1/ { limit_req zone=api burst=40 nodelay; proxy_read_timeout 15s; }

Common pitfalls

Unbounded limit parameters.
SMS/email endpoints without per-recipient caps (toll fraud).
No DB statement timeout.

Key points

Limit size, count, complexity, time and money
Per-recipient caps on paid side effects
Quotas per tenant

Limits checklist

Common pitfalls

Key points

Practice questions